The 3D Photo Gallery plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'des[]' parameter. Authenticated users with at least Subscriber privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the injected content. This vulnerability is present in all versions up to 1.3. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with Subscriber-level access or higher can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to the execution of arbitrary scripts in the browsers of users who view the compromised pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not impact system availability and has limited impact on confidentiality and integrity as per the CVSS score. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict Subscriber-level access where possible and consider disabling or removing the 3D Photo Gallery plugin if feasible. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'des[]' parameter may provide temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.